In the aftermath of the Boulder shooting, a variety of speculation about the attack made the rounds on Twitter. We categorized the tweets based on keywords used. The most common categories:
• apprehended + white
• Muslim, Syria(n), or ISIS
• Boebert
The themes of the tweets changed over time. Tweets mentioning vaccines were common early on, but were quickly eclipsed by the apprehended+white and Boebert categories. The Muslim/Syria and Washington Post/anti-Trump categories took off after the shooter's name was released.
Retweet network for tweets prior to the announcement of the shooter's name containing "Boulder" or "Table Mesa" and one or more of the keywords we analyzed. It's almost all left-wing accounts, mostly focused on the apprehended+white and assault rifle ban/overturn categories.
The same thing, but with several hours of tweets subsequent to the announcement of the shooter's name included as well. A right-wing cluster has appeared, focused on the Muslim/Syria tweets and tweets describing the shooter as anti-Trump and reading the Washington Post.
For the sake of example, here are some collages of tweets from four of the major categories (apprehended + white, Muslim/Syria(n)/ISIS, "assault rifle ban"/overturn, and anti-Trump/Washington Post).
• • •
Missing some Tweet in this thread? You can try to
force a refresh
By reverse image searching a GAN-generated face pic (i.e. the "faces" produced by thispersondoesnotexist.com), one can often find Twitter accounts with GAN-generated profile pics. Today's search led to a massive botnet with a bit of everything. #ThursdayShenaniGANs
This botnet consists of 16512 accounts, created in batches between February 18th and March 21st, 2021. All either follow or are followed by dozens or hundreds of other members of the botnet (and by very few accounts that are not part of the botnet).
The bots in this network are grouped into clusters of a few hundred accounts each that follow or are followed by many other accounts within their cluster. The accounts mostly don't follow accounts in other clusters, but do reply to them.
It's either the second day of spring or fall (depending on where you are), so here's a look at a botnet following the official Twitter account of right wing think tank @Heritage Foundation. #SundaySpam
This botnet consists of 28971 accounts, created Nov 2013 - Jan 2014. All their tweets were sent via "Twitter Web Client", and none has tweeted since 2014. None has liked a tweet, and all have the same display name as @-name (including lack of space between first and last name).
Who does this botnet follow? The majority of the beneficiaries of its bogus follows are the official accounts of businesses (including some fairly large companies such as @Citibank and @WhiteCastle). The @Heritage Foundation (followed by 2845 of the bots) is a notable outlier.
Some Twitter botnets do all sorts of elaborate things, but this is not one of them. The accounts in this botnet have thus far all followed exactly two accounts (@@polkastarter and @ConvergenceFin) and done nothing else - no tweets, no likes, no other follows.
This botnet consists of 1004 accounts created on February 25th and February 26th, 2021. In addition to the similarities already noted (no tweets, no likes, following the same two accounts), none has a biography or header image and all have female names.
Almost all of the accounts in this botnet do have profile pics, and (big shock) they appear to be stolen, with many of them having previously been used on other Twitter accounts, most of which are now suspended.
It's a day ending in "y", and a bunch of similar-looking accounts are attaching four letter codes to their otherwise identical tweets denying genocide and downplaying human rights abuses in Xinjiang. #TuesdayAstroturf
We found a network of 113 accounts posting duplicate tweets about Xinjiang with random four letter codes appended. All were created between December 2020 and February 2021, generally in batches of accounts with similar naming schemes. Most use photos of scenery as profile pics.
These 113 accounts (allegedly) post all of their tweets via the Twitter Web App, generally in brief tweetstorms where most/all of the accounts tweet within an hour or so of each other. Most tweets are in English or Chinese, but the network has tweeted in 31 languages thus far.
Most of the Twitter account listings on accs-market(dot)com include the account's @-name, but in this case the seller has hidden it. The account's display name, profile pic, and follower count are included, and it is apparently verified (blue check), so maybe we can find it.
Sure enough, a verified account named @DakotaPrukop (ID 310045063) exists and has roughly the same number of followers as the account advertised as for sale. It appears to have changed its profile pic, but a recent archive of its feed shows the same pic featured in the listing.